Security incident inbound email action has a confusing condition

Ravish Shetty · ‎08-23-2019

hi all,

we have the email inbound action part of the security incident response application and it has this out of box condition which I am not sure of

is it expecting recipients to have 'sn_si' in the email address? if that is the case, do we provision a mailbox with that text in the email address and use that mailbox to create security incident tickets? I can always modify the condition but don't want to customize this action.

Mohit Kaushik · ‎08-23-2019

Hi Ravish,

By the above screenshot of conditions it looks like it requires the recipients to have that sn_si in their email address, then only it will create or update the incident. I am not sure whether that is a required condition for this. But you can do it other way round by creating a custom action and action and make this one as false. In that way you will be having the main action as well and if you want to use it again just make the active true for the same.

Hope that helps you. Please mark it helpful if it really helped you.

Thanks,

Mohit Kaushik

Thanks,
Mohit Kaushik
ServiceNow MVP (2023-2025)

SanjivMeher · ‎08-23-2019

I dont think, thats an OOB inbound actions. Someone must have modified it.

But for Security Operations, we usually use an Email parser.

Please mark this response as correct or helpful if it assisted you with your question.

Ravish Shetty · ‎08-23-2019

based on the updated by and updated date it looks like it was part of the OOTB setup

SanjivMeher · ‎08-23-2019

Ok..I see that too

I think you need to change that with your company's id.

For ex, we check if recipient is csirt@mycompany.com. So you can replace sn_si with csirt or any email id thats used by your company.

Please mark this response as correct or helpful if it assisted you with your question.